Cross-site Request Forgery (CSRF) Affecting tornado package, versions [,3.2.2)

Threat Intelligence

0.49% (77^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-PYTHON-TORNADO-40301
published 26 May 2014
disclosed 26 May 2014
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 26 May 2014

CVE-2014-9720 Open this link in a new tab CWE-352 Open this link in a new tab

Overview

tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF).

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

Low
Integrity (I)

Low
Availability (A)

Low